fix: allow GitHub API requests in CSP

[amanyadavkr098-bot]

Summary [required]

This PR fixes the GitHub Skill Import feature, which was failing due to a Content Security Policy (CSP) restriction. The application attempted to fetch repository data directly from the GitHub API, but the existing CSP configuration only allowed connections to the application's own origin ('self'). As a result, GitHub API requests were blocked by the browser and users were unable to import skills from their GitHub profiles.

The CSP has been updated to allow requests to https://api.github.com, restoring the GitHub skill import functionality.

Related Issue [required]

Closes #1024

Type of Change [required]

• Bug fix — resolves a broken behaviour
• Feature — adds new functionality
• Data — adds new projects to data/projects.json
• Documentation — updates docs, README, or code comments only
• Style — CSS or visual changes only, no logic change
• Refactor — restructures code without changing behaviour
• Test — adds or updates tests

What Was Changed [required]

File	Change made
app.py	Updated the Content Security Policy header to allow connections to https://api.github.com and removed the duplicate CSP assignment block.

How to Test This PR [required]

1. Clone this branch:

   git checkout fix/github-sync-csp

2. Install dependencies:

   pip install -r requirements.txt

3. Run the application:

   python app.py

4. Open http://127.0.0.1:5000

5. Click Import from GitHub

6. Enter a valid GitHub username (e.g. torvalds)

7. Click Fetch Skills

8. Verify that skills are successfully imported and no CSP errors appear in the browser console.

9. Run tests:

   python tests/test_basic.py

Expected Result

• GitHub skills are imported successfully.
• No Content-Security-Policy errors appear in the browser console.
• All tests pass.

Test Results [required]

Paste output from:
python tests/test_basic.py

Screenshots (if UI change)

Not applicable (no UI changes).

Self-Review Checklist [required]

• I have read CONTRIBUTING.md and followed all guidelines
• My branch name follows the convention: fix/
• I have run python tests/test_basic.py and all tests pass
• I have run flake8 . locally and there are no errors
• I have not introduced any print() or console.log() debug statements
• Every new function I wrote has a docstring
• I have not modified files outside the scope of the linked issue
• If I changed the UI, I tested it at 375px (mobile) and 1280px (desktop)
• If I added a project to the dataset, it has all required JSON fields

Notes for Reviewer

The GitHub Skill Import feature was failing because the browser blocked requests to the GitHub API due to the CSP directive:

connect-src 'self'

This PR updates the directive to:

connect-src 'self' https://api.github.com

allowing the existing GitHub integration to function as intended without modifying application logic.

[vercel]

@amanyadavkr098-bot is attempting to deploy a commit to the komalsony234-1530's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Thank you for submitting your first pull request to DevPath.

Before review:

• Complete the PR template fully
• Ensure all tests pass
• Link your PR to an issue
• Keep changes scoped to the issue

A maintainer will review your contribution soon.

[amanyadavkr098-bot]

@komalharshita please review this PR for any updates.

[amanyadavkr098-bot]

@komalharshita / maintainers please review this PR

[amanyadavkr098-bot]

@komalharshita please verify this PR FOR ANY CHANGES REQUIRED.

[amanyadavkr098-bot]

@komalharshita please review this PR for any Updates.......

[amanyadavkr098-bot]

@komalharshita pls review this PR

[amanyadavkr098-bot]

@komalharshita please go through this PR

[amanyadavkr098-bot]

@komalharshita please go through this PR

[amanyadavkr098-bot]

@komalharshita please review this PR

[amanyadavkr098-bot]

@komalharshita please review this PR

[amanyadavkr098-bot]

@komalharshita please review this PR

[komalharshita]

@amanyadavkr098-bot kindly resolve the merge conflicts

[amanyadavkr098-bot]

@komalharshita please review this Pr the merge conflict is resolved

[komalharshita]

Thanks for addressing this issue! The fix is straightforward and resolves the CSP restriction that was preventing GitHub API requests from reaching https://api.github.com.

Updating the Content Security Policy while removing the duplicate CSP assignment keeps the implementation clean and restores the GitHub skill import functionality without introducing unnecessary changes.

The scope is well-defined, directly addresses the reported bug, and the testing steps are clear. Nice work!

Approved for merge. ✅